Documentation
¶
Overview ¶
Package servingcert keeps a self-signed CA and a serving cert for an in-cluster Service in a Secret, and renews them. vela-core uses it for the cluster-gateway APIService when it runs with --cluster-gateway-tls-secret, and for its admission webhooks when it runs with --webhook-tls-secret. It replaces the kube-webhook-certgen Jobs that the chart ran as Helm hooks.
The CA is long-lived, and the Secret keeps its key. When a serving cert expires, EnsureSecret signs a new one with the same CA, so the caBundle that clients trust does not change.
Sometimes the CA itself must change: it expires, or the old Jobs made the Secret without a CA key. Then the old CA stays trusted for caOverlap. Servers that still use the old cert keep working until they load the new one.
Index ¶
- Constants
- func Check(data map[string][]byte, hosts []string, validUntil time.Time) error
- func Covers(trusted, bundle []byte) bool
- func Generate(hosts []string, notBefore, notAfter time.Time) (map[string][]byte, error)
- func WriteFileIfChanged(path string, data []byte) (bool, error)
- type Result
- type Service
Constants ¶
const ( // CAKey is the Secret key holding the PEM CA. The old Jobs used the same // keys for the CA, cert and key. CAKey = "ca" // CAKeyKey is the Secret key holding the PEM private key of the CA. CAKeyKey = "ca.key" // CertKey is the Secret key holding the PEM serving cert. CertKey = "tls.crt" // KeyKey is the Secret key holding the PEM private key of the serving cert. KeyKey = "tls.key" // PreviousCAKey is the Secret key holding the CA that was replaced last, // trusted until the time in PreviousCAUntilAnnotation. PreviousCAKey = "ca.previous" // PreviousCAUntilAnnotation is the RFC 3339 time until which PreviousCAKey // stays in the CA bundle. PreviousCAUntilAnnotation = "servingcert.oam.dev/previous-ca-until" )
Variables ¶
This section is empty.
Functions ¶
func Check ¶
Check returns nil if data holds a key pair whose cert chains to the CA, covers every host and is valid at validUntil. If not, it returns the reason.
func Generate ¶
Generate makes a self-signed CA and uses it to sign a serving cert for hosts. Both are valid from notBefore to notAfter. It returns them as Secret data.
func WriteFileIfChanged ¶
WriteFileIfChanged writes data to path, creating its directory, unless the file already holds it, and reports whether it wrote. The file is always left readable by its owner only, also when it already existed with wider permissions, because it can hold a private key.
Types ¶
type Result ¶
type Result struct {
// Cert and Key are the PEM serving cert and its private key.
Cert, Key []byte
// CABundle is what clients should trust: the CA, plus the previous CA while
// it is still within caOverlap.
CABundle []byte
}
Result is what EnsureSecret returns.
func EnsureSecret ¶
func EnsureSecret(ctx context.Context, c client.Client, namespace, name string, svc Service) (*Result, error)
EnsureSecret returns the serving cert for svc from the Secret <namespace>/<name>. It creates, renews or replaces the cert as necessary. It does not change a valid Secret, including one that the old Jobs made. It is safe to call often and from several replicas at the same time.
type Service ¶
Service is the Service a serving cert is for.
func (Service) RequiredHosts ¶
RequiredHosts are the names that clients dial. EnsureSecret reuses a cert only if it covers all of them. The old kube-webhook-certgen Jobs made certs with exactly these names, so their Secrets stay valid after an upgrade.
Source Files